Alarm reduction and correlation in intrusion detection systems

Lecture Notes in Informatics (LNI), Proceedings - Series of the Gesellschaft fur Informatik (GI)

Volumn P 46, Issue , 2004, Pages 9-24

  Chyssler, Tobias ^a   Burschka, Stefan ^b   Semling, Michael ^b   Lingvall, Tomas ^b   Burbeck, Kalle ^a  

^a LINKÖPING UNIVERSITY   (Sweden)

^b Swisscom AG   (Switzerland)

Author keywords

[No Author keywords available]

Indexed keywords

ADAPTIVE FILTERING; ADAPTIVE FILTERS; ALARM SYSTEMS; COMPUTER CRIME; MALWARE; REDUNDANCY;

ALARM REDUCTION; COMPLEX INFRASTRUCTURES; DEPENDABLE NETWORK; HUMAN OPERATOR; INTRUSION DETECTION SYSTEMS; IP NETWORKS; LARGE SYSTEM;

INTRUSION DETECTION;

EID: 85016644052     PISSN: 16175468     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (21)

1. S. Managanaris, M. Christensen, D. Zerkle, and K. Hermiz, A Data Mining Analysis of RTID Alarms, Computer Networks, 34(4), Elsevier pub., Oct 2000.
2. K. Burbeck, S. Nadjm-Tehrani, "ADWICE - Anomaly Detection with Fast Incremental Clustering.", Technical Report, Dept. of Computer and Information Science, Linköping University. February 2004.
3. K. Burbeck, S. G. Andres, S. Nadjm-Tehrani, M. Semling, and T. Dagonnier. “Time as a Metric for Defence in Survivable Networks”. Proceedings of the Work in Progress session of 24th IEEE Real-Time Systems Symposium (RTSS 2003), Dec. 2003.
4. T. Chyssler. “Reducing False Alarm Rates in Intrusion Detection Systems”, Master thesis No. LITH-IDA-EX-03/067-SE, Linköping University (2003).
5. F. Cuppens and A. Miége. “Alert Correlation in a Cooperative Intrusion Detection Framework”. Proceedings of the 2002 IEEE Symposium on Security and Privacy. 2002. Pages 187 - 200.
6. L.Devroy, L. Györfi and G. Lugosi. “A Probabilistic Theory of pattern Recognition”. Springer Verlag, New York Inc, 1996.
7. H. Debar and A. Wespi. “Aggregation and Correlation of Intrusion-Detection Alerts”. Proceedings of the fourth International Symposium on Recent Advances in Intrusion Detection (RAID). Springer Verlag, October 2001. Pages 85-103.
8. D. Heckerman. “A Tutorial on Learning With Bayesian Networks”. Technical Report MSR-TR-95-06, Microsoft Research. March 1995 (Revised November 1996).
9. J. Haines, D. K. Ryder, L. Tinnel and S. Taylor. “Validation of Sensor Alert Correlators”., Security & Privacy Magazine, IEEE, Vol. 1, No. 1. January/February 2003. Pages. 46 - 56.
10. J. McHugh. “Intrusion and Intrusion Detection”. International Journal of Information Security. Vol 1, No 1. Springer Verlag, August 2001. Pages 14 - 35.
11. K. Julisch and M. Dacier. “Mining Intrusion Detection Alarms for Actionable Knowledge”. Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining. ACM Press, July 2002. Pages 366-375.
12. B. Morin and H. Debar. “Correlation of Intrusion Symptoms: an Application of Chronicles”. Proceedings of the sixth International Symposium on Recent Advances in Intrusion Detection (RAID). Springer Verlag, November 2003. Pages 97 - 112.
13. P. Ning. Y. Cui and D. S. Reeves. “Constructing Attack Scenarios through Correlation of Íntrusion Alerts”. Proceedings of the 9th ACM conference on Computer and communications security. ACM Press, 2002. Pages 245 - 254.
14. P. A. Porras, M. W. Fong and A. Valdes.”A Mission-Impact-Based Approach to INFOSEC Alarm Correlation”. Proceedings of the fifth International Symposium on Recent Advances in Intrusion Detection (RAID). Springer Verlag, October 2002. Pages 95-114.
15. X. Qin and W. Lee. “Statistical Causality Analysis of INFOSEC Alert Data”. Proceedings of the sixth International Symposium on Recent Advances in Intrusion Detection (RAID). Springer Verlag, November 2003. Pages 73 - 93.
16. Safeguard website: http://www.ist-safeguard.org.
17. P. Scerri.”Designing Agents for Systems with Adjustable Autonomy”. PhD thesis No. 724, Linköping University (2001).
18. J. Sima. “Introductions to Neural Networks”. Technical report No V-755, ICS CAS, Prague, 1998.
19. A. Valdes and K. Skinner.”Probabilistic Alert Correlation”. Proceedings of the fourth International Symposium on Recent Advances in Intrusion Detection (RAID). Springer Verlag, October 2001. Pages 54-68.
20. V. Yegneswaran, P. Barford and J. Ullrich. “Internet Intrusions: Global Characteristics and Prevalence”. Proceedings of the 2003 ACM SIGMETRICS international conference on Measurement and Modelling of Computer Systems, June 2003. Pages 138-147.
21. X. Yin, K. Lakkaraju, Y. Li and W. Yurcik.”Selecting Log Data Sources to Correlate Attack Traces for Computer Network Security: Preliminary Results”. Proceedings of the 11th International Conference on Telecommunication Systems, Modelling and Analysis, October 2003.